View Source: WPAD - Waikato Linux Users Group

Edit PageHistory Diff Info LikePages
[Acronym] for __W__eb __P__roxy __A__uto__d__iscovery Protocol.

WPAD lets web browsers automatically find and use a WebProxy (see our ProxyServerNotes).  A reasonable starting point for WPAD is here: http://www.squid-cache.org/Doc/FAQ/FAQ-5.html#ss5.10

WPAD lets you use many methods to automatically specify a proxy server configuration file on the network - [DHCP], [DNS], or manual specification.  The file is a .PAC (Proxy Auto Configuration) file, which is defined in Netscape's [definition of PAC files | http://home.netscape.com/eng/mozilla/2.0/relnotes/demo/proxy-live.html].

----

!!! The Easy Method

# If all your clients are <tt>something.yourdomain.tla</tt> (the connection suffix is assigned with [DHCP] - if you're unsure, and running Windows, run <tt>ipconfig</tt> from a command prompt).

# Set your gateway machine up so that it has a CNAME for <tt>wpad.yourdomain.tla</tt> pointing to <tt>server.yourdomain.tla</tt>

# Copy something like this into your document root as <tt>wpad.dat</tt>:

  <verbatim>
  function FindProxyForURL(url, host)
  {
      if( shExpMatch(url, "!https:*") || isPlainHostName(host) || \
          dnsDomainIs(host, ".yourdomain.tla") || dnsDomainIs(host, ".youralias.tla") )
      {
          return "DIRECT";
      } else {
          return "PROXY www-cache.yourdomain.tla:3128; DIRECT";
      }
  }
  </verbatim>

# Check you can access it by going <tt>~http://wpad.yourdomain.tla/wpad.dat</tt>.

# Make Apache serve it with the correct [MIME] type (<tt>application/x-ns-proxy-autoconfig</tt>) using a virtual host in your [Apache] configuration file (<tt>/etc/apache/httpd.conf</tt>):

  <verbatim>
  <VirtualHost ip.ad.dr.es>
      ServerName wpad.yourdomain.tla
      ServerAlias ip.ad.dr.ess
      AddType application/x-ns-proxy-autoconfig .dat
  </VirtualHost>
  </verbatim>

  (The alias is added because MSIE 6.00.2800.1106 on Win98SE does not look up the hostname.)

----

InternetExplorer has a "Automatically detect settings" check box.  This will cause the browser to search for the configuration file.

If your DomainName is machine.something.meta.net.nz then InternetExplorer will request the following [URL]s until it finds a [WPAD] configuration file.

* <tt>~http://wpad.something.meta.net.nz/wpad.dat</tt>
* <tt>~http://wpad.meta.net.nz/wpad.dat</tt>
* <tt>~http://wpad.net.nz/wpad.dat</tt>

(It’s only supposed to check to the second level, but according to the [Microsoft Security Bulletin MS99-054 | http://www.microsoft.com/technet/security/bulletin/ms99-054.mspx] the third level was special-cased in some unspecified ways. Presumably someone could register <tt>wpad.co.nz</tt> and be really nasty if they wanted.)

(BeauButler: I _have_ registered wpad.co.nz, and do _not_ intend to be 'really nasty'. I am collecting the 404 logs with the intention to produce some nice charts, hoever. Also, the wpad organisational-boundaries bug appears to have _resurfaced_ in Internet Explorer 7!!)

  ''<tt>wpad.com</tt> does actually exist and is owned by Duane Wessles, the author of [Web Caching | http://www.oreilly.com/catalog/webcaching/]. There's no <tt>wpad.dat</tt> there. I mailed him a while back asking about it, and he constantly gets between 10 and 40 hits per second depending on the time of day. The 404 logs for that site are at http://www.life-gone-hazy.com/%7esnmp/http_status.cgi if you're interested.'' —zcat(1)

Note: you might need to take the tick out of the check box and put it back in order to make it go.

Warning: beware that Internet Explorer 5.5+ may cache your wpad file and not recognize future changes you make to it -- this feature is referred to as Automatic Proxy Result Cache ([MS KB 271361 | http://support.microsoft.com/default.aspx?scid=kb;EN-US;271361]).  If you turn off "Automatically detect settings", save the change, restart IE, turn it back on, and restart IE again, then it will force a refresh of the <tt>wpad.dat</tt> file from your WebServer. (If you're lucky. It seems IE 6 refuses to flush even then.) Here is [a Google Groups discussion of the issue | http://groups.google.com/groups?selm=b6239t%24mif%241%40FreeBSD.csie.NCTU.edu.tw].

Some versions of IE have a bug and request wpad.da instead of wpad.dat. Copying or linking wpad.dat to wpad.da should work around this. Don't forget to set the appropriate [MIME] type for this file as well.

----

!!! Other alternatives

(Substitute <tt>host.co.nz</tt> for your hostname in these examples.)


!! The DHCP method

MicrosoftCorporation's "preferred option", which like most MSFT'isms, doesn't actually work.

Add the following to your <tt>/etc/dhcpd.conf</tt>:

<verbatim>
option option-252               "http://wpad.host.co.nz/proxy.pac";
</verbatim>

With ISC DHCP v3+, <tt>option-#</tt> options don't work. You have to do this in the global section of your configuration:

<verbatim>
option wpad-url    code 252 = text;    (define a new option)
</verbatim>

And add this in either the global or appropriate subnet section(s) of your configuration:

<verbatim>
option wpad-url    "http://wpad.my.domain.tld/proxy.pac\n";    (use new option)
</verbatim>

You might like to try using an [IP] address there instead; there has been a report that a [DNS] name doesn't work, but no indication on what version of dhcpd(8).

__NOTE__:
It seems that IE eats the last character of the URL given in option 252. You have to append a space there (or any other character) to get it working:

<verbatim>
option wpad-url               "http://wpad.my.domain.tld/proxy.pac ";
</verbatim>

(tested with ISC DHCPD server v3.0.1 and MS IE v6.0 SP2).  Alternatively (in case this is fixed in future) you may wish to have an autoproxy file with the last letter missing, e.g. "ln -s proxy.pac proxy.pa" (tested and works with the default XP x64 install in Aug 2007, which didn't seem to work with a trailing space in the DHCP option.)

or if you're configuring a Windows DHCP server, right click on the server and click "Set predefined options" to add 252 as a String value (it's not in there by defult. See [MS KB 252898 | http://support.microsoft.com/default.aspx?scid=kb;EN-US;252898] for more.)

!! The DNS method(s)

Add all or some of the follwing entries to your DNS zone file.

<verbatim>
$ORIGIN host.co.nz.
wpad            IN      A       192.168.0.254
                IN      TXT     "service: wpad:!http://wpad.host.co.nz:80/proxy.pac"
wpad.tcp        IN      SRV     0 0 80 wpad.host.co.nz.
</verbatim>

!!! See also

* RFC:2052
* RFC:3040
* [Internet Draft on WPAD|http://www.web-cache.com/Writings/Internet-Drafts/draft-ietf-wrec-wpad-01.txt]
* [http://wiki.debian.org/ProxyAutodetectConf]
* [Super Proxy Scripts|http://naragw.sharp.co.jp/sps/]

----

!!Konqueror and isInNet() function

Michael Zieger writes:

If you try to use a wpad.dat in Konqueror (I tested version 3.2.2), be aware that the following does NOT work:

<verbatim>
if (isInNet(myIpAddress(), "10.0.0.0", "255.0.0.0") || isInNet(myIpAddress(), "192.168.0.0", "255.255.0.0"))
</verbatim>

It seems Konqueror does not know the function "isInNet". Therefore, I changed the config slightly:

<verbatim>
var proxy_yes = "PROXY proxy.i.zmi.at:3128; DIRECT";
var proxy_no = "DIRECT";

// WARNING: The "dnsDomainIs" is a check of which DNS domain the _client_
//          is inside. It's not a check for where the client wants to go!!!
// if (dnsDomainIs( host,"zmi.at") { return proxy_no; }
// Proxy if PC is on local LAN - doesn't work with Konqueror!
// So this test is for Internet Explorer and compatible only
if (isInNet(myIpAddress(), "10.0.0.0", "255.0.0.0") || isInNet(myIpAddress(), "192.168.0.0", "255.255.0.0")) {
    if(
        url.substring(0, 5) == "http:"
        || url.substring(0, 4) == "ftp:"
        || url.substring(0, 7) == "gopher:"
    )
        return proxy_yes;
    else
        return proxy_no;
}

// Konqueror comes until here:
if(
    url.substring(0, 5) == "http:"
    || url.substring(0, 4) == "ftp:"
    || url.substring(0, 7) == "gopher:"
)
    return proxy_yes;
else
    return proxy_no;
</verbatim>

Now you even can differentiate between Konqueror and InternetExplorer, and could give them different proxies. If you want to download the running config, visit http://zmi.at/wpad.dat.

Kasper Sandberg reports that isInNet works with a proxy.pac file in 3.5.3.

----

!!Localhost routing broken

Google Desktop Search being blocked?  Add an <tt>isInNet(host, "127.0.0.0", "255.0.0.0")</tt>:

<verbatim>
function FindProxyForURL(url, host)
{
  if (
      dnsDomainIs(host, ".local") ||
      isInNet(host, "127.0.0.1", "255.255.255.255") ||
      isInNet(host, "10.7.x.0", "255.255.255.0") ||
      isPlainHostName(host)
      )
      return "DIRECT";
  else
      return "PROXY wherever:8080; DIRECT";
}
</verbatim>

----
CategorySystemAdministration
6 pages link to WPAD:
Last edited on Saturday, March 19, 2011 6:43:39 pm by JohnMcPherson
Edit PageHistory Diff Info LikePages